@proteinjs/user-server 1.21.1 → 1.22.1

package/src/authentication/PasswordResetToken.ts

@@ -13,22 +13,42 @@ export type PasswordResetResolution =
  * The password-reset token's one owner: its shape, its mint, the lookup that maps a presented
  * value back to the user it was issued to, and its single-use redemption.
  *
- * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters),
- * stored on the user row beside its expiry until it is redeemed or expires.
+ * A token is 32 bytes from the platform CSPRNG, hex-encoded (64 lowercase hex characters). The
+ * token itself exists only in the link mailed to the account: the user row stores its SHA-256
+ * digest (hex) beside the expiry, never the token, so a read of the table yields nothing that
+ * can be presented. A digest is not a token — presenting one is hashed again and matches no row.
+ * A fast unsalted hash is enough here because the input is 256 bits of CSPRNG output, not a
+ * human-chosen secret.
  *
- * Resolution refuses anything that is not a value of that shape BEFORE any lookup. A query
- * filter built from a request value that is not a token does not compare the way a token does:
- * `null` renders as `IS NULL` and would match every account with no pending reset, an empty
- * string matches an emptied column, and other types reach the driver. The row the lookup
- * returns is then re-checked in code — its stored token must be a string equal to the presented
- * one (compared in constant time) and its expiry a real timestamp still in the future — so the
+ * Resolution refuses anything that is not a value of the token's shape BEFORE any lookup. A
+ * query filter built from a request value that is not a token does not compare the way a token
+ * does: `null` renders as `IS NULL` and would match every account with no pending reset, an
+ * empty string matches an emptied column, and other types reach the driver. The presented token
+ * is then hashed, the row is looked up by that digest, and the row the lookup returns is
+ * re-checked in code — its stored digest must be a string equal to the presented token's digest
+ * (compared in constant time) and its expiry a real timestamp still in the future — so the
  * outcome never rests on how the storage compares.
+ *
+ * No migration accompanies the move from a stored token to a stored digest: a row that still
+ * holds a token minted before it never equals the digest of anything presented, so that token
+ * fails validation for what remains of its hour and the person asks for a new link.
  */
 export class PasswordResetToken {
   private static readonly SHAPE = /^[0-9a-f]{64}$/;
+  private static readonly LIFETIME_MINUTES = 60;
 
-  mint(): string {
-    return randomBytes(32).toString('hex');
+  /**
+   * Issue a token to `user`: store its digest and its expiry on the row, replacing any token
+   * outstanding, and return the token — the only time it exists outside the mailed link.
+   */
+  async mint(user: User): Promise<string> {
+    const token = randomBytes(32).toString('hex');
+    await getDbAsSystem().update(tables.User, {
+      id: user.id,
+      passwordResetToken: this.digest(token),
+      passwordResetTokenExpiration: moment().add(PasswordResetToken.LIFETIME_MINUTES, 'minutes'),
+    });
+    return token;
   }
 
   async resolve(presented: unknown): Promise<PasswordResetResolution> {
@@ -37,8 +57,9 @@ export class PasswordResetToken {
       return { status: 'malformed' };
     }
 
-    const user = await getDbAsSystem().get(tables.User, { passwordResetToken: token });
-    if (!user || !this.matches(user.passwordResetToken, token)) {
+    const digest = this.digest(token);
+    const user = await getDbAsSystem().get(tables.User, { passwordResetToken: digest });
+    if (!user || !this.matches(user.passwordResetToken, digest)) {
       return { status: 'unknown' };
     }
 
@@ -51,38 +72,71 @@ export class PasswordResetToken {
 
   /**
    * Write the new credential and clear the token in one conditional update: the row must still
-   * carry this token at write time, so two presentations of the same token cannot both succeed.
-   * Resolves false when the token was already redeemed.
+   * carry this token's digest at write time, so two presentations of the same token cannot both
+   * succeed. Resolves false when the token was already redeemed.
    */
   async redeem(user: User, token: string, hashedPassword: string): Promise<boolean> {
     const updated = await getDbAsSystem().update(
       tables.User,
       { password: hashedPassword, passwordResetToken: null, passwordResetTokenExpiration: null },
-      { id: user.id, passwordResetToken: token }
+      { id: user.id, passwordResetToken: this.digest(token) }
     );
     return updated === 1;
   }
 
-  /** A log-safe reference to a presented token: a short digest of a well-formed one, never the value itself. */
+  /**
+   * Withdraw a token that never reached its owner (the mail carrying it failed to send): the row
+   * is cleared only while it still carries this token's digest, so a newer token is left alone.
+   */
+  async revoke(user: User, token: string): Promise<void> {
+    await getDbAsSystem().update(
+      tables.User,
+      { passwordResetToken: null, passwordResetTokenExpiration: null },
+      { id: user.id, passwordResetToken: this.digest(token) }
+    );
+  }
+
+  /** When the token outstanding on `user` was minted, or undefined when the row carries none. */
+  mintedAt(user: User): Moment | undefined {
+    if (!user.passwordResetToken || !user.passwordResetTokenExpiration) {
+      return undefined;
+    }
+
+    return moment(user.passwordResetTokenExpiration).subtract(PasswordResetToken.LIFETIME_MINUTES, 'minutes');
+  }
+
+  /**
+   * A log-safe reference to a presented token: a short prefix of a well-formed one's digest,
+   * never the value itself and never a part of it. The routes log it only for a token that
+   * resolved `unknown` — one no row carries — so it never lines up with a digest a row holds.
+   * What it is for is telling refusals apart in the log: one stale link presented again reads
+   * the same each time, a run of different values reads differently. 48 bits of the SHA-256 of
+   * 256 random bits identify nothing and can be presented nowhere.
+   */
   fingerprint(presented: unknown): string | undefined {
     const token = this.parse(presented);
     if (token === undefined) {
       return undefined;
     }
 
-    return createHash('sha256').update(token).digest('hex').slice(0, 12);
+    return this.digest(token).slice(0, 12);
   }
 
   private parse(presented: unknown): string | undefined {
     return typeof presented === 'string' && PasswordResetToken.SHAPE.test(presented) ? presented : undefined;
   }
 
-  private matches(stored: string | null | undefined, presented: string): boolean {
-    if (typeof stored !== 'string' || stored.length !== presented.length) {
+  /** What the row stores in place of a token: its SHA-256, hex-encoded. */
+  private digest(token: string): string {
+    return createHash('sha256').update(token).digest('hex');
+  }
+
+  private matches(storedDigest: string | null | undefined, presentedDigest: string): boolean {
+    if (typeof storedDigest !== 'string' || storedDigest.length !== presentedDigest.length) {
       return false;
     }
 
-    return timingSafeEqual(Buffer.from(stored), Buffer.from(presented));
+    return timingSafeEqual(Buffer.from(storedDigest), Buffer.from(presentedDigest));
   }
 
   private isLive(expiration: Moment | null | undefined): boolean {

package/src/routes/devLogin.ts

@@ -45,7 +45,7 @@ const emailDomain = (address: string) => address.slice(address.lastIndexOf('@')
  * call is unchanged; the variable absent = nothing changes; the gates closed = 404 regardless.
  * Test and prod never set it — the omission is the safety, the same idiom as the gates. The
  * outcome is logged as ONE marker line, `Dev bootstrap admin door: <granted|admin-exists>`,
- * which the n3xa compose-estate boot proof reads from the server log to PROVE the grant landed.
+ * which a consumer's boot proof can read from the server log to PROVE the grant landed.
  *
  * Role-bootstrap door (`DEV_BOOTSTRAP_ROLES='email:role[,role];email:role…'`, the grammar in
  * DevBootstrapRoles.ts): the first-admin door leaves every OTHER account role-less, and a

package/src/routes/devMail.ts

@@ -0,0 +1,72 @@
+import { Route } from '@proteinjs/server-api';
+import { MailSink } from '@proteinjs/email-server';
+
+/**
+ * DEV-ONLY mail door: reads the process's mail sink (`@proteinjs/email-server` MailSink — the
+ * messages a development sender recorded instead of transporting), so automated dev-loop testing
+ * reads an invite or reset link from the sink instead of needing a real inbox, and nothing a dev
+ * server composes ever has to reach a real address to be verified.
+ *
+ *   GET /dev/mail[?n=<count>]  the last n messages (default 20, at most MailSink.CAPACITY), newest
+ *                              first: id, at, from, to, subject, the body's first link, refused, url
+ *   GET /dev/mail/<id>         the rendered message — its html part, or its text part as text/plain
+ *
+ * Double-gated exactly like `/dev/login` (devLogin.ts), acting only when BOTH hold; otherwise the
+ * paths answer 404 as if unregistered:
+ * 1. `process.env.DEVELOPMENT` — the dev-server switch, never set in prod images.
+ * 2. `DEV_AUTO_LOGIN_EMAIL` — the explicit per-launch dev opt-in.
+ */
+const DEFAULT_COUNT = 20;
+
+const gatesOpen = (): boolean =>
+  !!process.env.DEVELOPMENT && (process.env.DEV_AUTO_LOGIN_EMAIL ?? '').trim().length > 0;
+
+export const devMail: Route = {
+  path: '/dev/mail',
+  method: 'get',
+  onRequest: async (request, response): Promise<void> => {
+    if (!gatesOpen()) {
+      response.status(404).send();
+      return;
+    }
+    const requested = Number(request.query?.n);
+    const count = Number.isInteger(requested) && requested > 0 ? Math.min(requested, MailSink.CAPACITY) : DEFAULT_COUNT;
+    const messages = MailSink.get()
+      .list(count)
+      .map(({ id, at, from, to, subject, link, refused }) => ({
+        id,
+        at,
+        from,
+        to,
+        subject,
+        link,
+        refused,
+        url: `/dev/mail/${id}`,
+      }));
+    response.status(200).json({ messages });
+  },
+};
+
+export const devMailMessage: Route = {
+  path: '/dev/mail/:id',
+  method: 'get',
+  onRequest: async (request, response): Promise<void> => {
+    if (!gatesOpen()) {
+      response.status(404).send();
+      return;
+    }
+    const record = MailSink.get().get(String(request.params?.id ?? ''));
+    if (!record) {
+      response.status(404).send();
+      return;
+    }
+    if (record.html !== undefined) {
+      response.status(200).type('html').send(record.html);
+      return;
+    }
+    response
+      .status(200)
+      .type('text')
+      .send(record.text ?? '');
+  },
+};

package/src/routes/executePasswordReset.ts

@@ -10,7 +10,8 @@ import { PasswordResetToken } from '../authentication/PasswordResetToken';
  * Resolves the presented token through `PasswordResetToken` — which refuses anything but a
  * well-formed token before any lookup — checks its expiry, and redeems it: the new password is
  * written and the token cleared in one conditional update, so a token resets a password once.
- * The token itself never reaches the log.
+ * The token itself never reaches the log. A request that carries no body at all is refused like
+ * one that carries a blank password.
  *
  * @bodyParam {string} token - The password reset token.
  * @bodyParam {string} newPassword - The new password for the user.
@@ -20,7 +21,7 @@ export const executePasswordReset: Route = {
   method: routes.executePasswordReset.method,
   onRequest: async (request, response): Promise<void> => {
     const logger = new Logger({ name: 'executePasswordReset' });
-    const { token, newPassword } = request.body;
+    const { token, newPassword } = request.body ?? {};
     if (typeof newPassword !== 'string' || newPassword.length === 0) {
       response.status(400).send({ error: 'New password cannot be blank' });
       return;

package/src/routes/initiatePasswordReset.ts

@@ -12,8 +12,9 @@ import { PasswordResetToken } from '../authentication/PasswordResetToken';
 /**
  * Route for initiating a password reset process.
  *
- * This route handles the process of generating a password reset token,
- * sending a reset email to the user, and storing the token and expiration of the token in the database.
+ * Mints a reset token through `PasswordResetToken` — which stores only the token's digest and
+ * its expiry on the user row — and mails the token to the account as a reset link. The token is
+ * withdrawn again when the mail fails to send.
  *
  * Requires an implementation of `DefaultPasswordResetEmailConfigFactory` to build the password reset email with.
  *
@@ -27,7 +28,13 @@ export const initiatePasswordReset: Route = {
   method: routes.initiatePasswordReset.method,
   onRequest: async (request, response): Promise<void> => {
     const logger = new Logger({ name: 'initiatePasswordReset' });
-    const email = request.body.email?.toLowerCase();
+    const { email: requestedEmail } = request.body ?? {};
+    if (typeof requestedEmail !== 'string' || requestedEmail.length === 0) {
+      response.status(400).send({ error: 'Email cannot be blank' });
+      return;
+    }
+
+    const email = requestedEmail.toLowerCase();
     const db = getDbAsSystem();
 
     const genericResponse = { message: 'If an account with that email exists, we have sent a password reset link.' };
@@ -41,15 +48,12 @@ export const initiatePasswordReset: Route = {
     }
 
     // Check if there's an existing token and it's less than 5 minutes old
-    if (user.passwordResetToken && user.passwordResetTokenExpiration) {
-      const currentTime = moment();
-      const tokenCreationTime = moment(user.passwordResetTokenExpiration).subtract(1, 'hour');
-      const timeDifference = currentTime.diff(tokenCreationTime, 'minutes');
-      if (timeDifference < 5) {
-        logger.info({ message: `Password reset requested too soon for user`, obj: { email } });
-        response.send(genericResponse);
-        return;
-      }
+    const resetToken = new PasswordResetToken();
+    const mintedAt = resetToken.mintedAt(user);
+    if (mintedAt && moment().diff(mintedAt, 'minutes') < 5) {
+      logger.info({ message: `Password reset requested too soon for user`, obj: { email } });
+      response.send(genericResponse);
+      return;
     }
 
     const emailSender = new EmailSender();
@@ -61,9 +65,8 @@ export const initiatePasswordReset: Route = {
       );
     }
 
-    // Generate reset token
-    const passwordResetToken = new PasswordResetToken().mint();
-    const passwordResetTokenExpiration = moment().add(1, 'hour');
+    // The row now holds the token's digest; the token itself goes only into the mailed link
+    const passwordResetToken = await resetToken.mint(user);
 
     try {
       const config = defaultConfigFactory.getConfig();
@@ -78,11 +81,11 @@ export const initiatePasswordReset: Route = {
         ...config.options,
       });
 
-      // If email is sent successfully, save reset token to user record
-      await db.update(tables.User, { id: user.id, passwordResetToken, passwordResetTokenExpiration });
       response.send(genericResponse);
     } catch (error: any) {
       logger.error({ message: `Failed to send password reset email`, obj: { email }, error });
+      // The link never reached the account: withdraw the token so asking again is not throttled
+      await resetToken.revoke(user, passwordResetToken);
       response.status(500).send({ error: 'Failed to send password reset email. Please try again later.' });
     }
   },

package/test/DbTraffic.ts

@@ -0,0 +1,43 @@
+import { Db, DbDriver } from '@proteinjs/db';
+
+/**
+ * What reached the database while a run executed — the outcome a "refused before any lookup"
+ * claim rests on. A response code cannot prove it: a value that is wrongly let through still
+ * matches no row and still answers 400, so the proof is that nothing was built and nothing ran.
+ * - `lookups`: the filter of every read built through the package's `Db` — every `query`, which
+ *   is also what a `get` is (the first row of one);
+ * - `writes`: how many writes were built through it (`insert`, `update`, `delete`);
+ * - `statements`: how many statements the driver ran, whoever built them.
+ */
+export class DbTraffic {
+  private constructor(
+    readonly lookups: unknown[],
+    readonly writes: number,
+    readonly statements: number
+  ) {}
+
+  /** The traffic of a run that never touched the database: `expect(traffic).toEqual(DbTraffic.NONE)`. */
+  static readonly NONE = { lookups: [], writes: 0, statements: 0 };
+
+  /** Runs `run` and answers what it resolved to beside the database traffic it caused. */
+  static async during<T>(driver: DbDriver, run: () => Promise<T>): Promise<{ result: T; traffic: DbTraffic }> {
+    const reads = jest.spyOn(Db.prototype, 'query');
+    const writes = [
+      jest.spyOn(Db.prototype, 'insert'),
+      jest.spyOn(Db.prototype, 'update'),
+      jest.spyOn(Db.prototype, 'delete'),
+    ];
+    const statements = [jest.spyOn(driver, 'runQuery'), jest.spyOn(driver, 'runDml')];
+    try {
+      const result = await run();
+      const lookups = reads.mock.calls.map(([_table, filter]) => filter);
+      return { result, traffic: new DbTraffic(lookups, DbTraffic.callCount(writes), DbTraffic.callCount(statements)) };
+    } finally {
+      [reads, ...writes, ...statements].forEach((spy) => spy.mockRestore());
+    }
+  }
+
+  private static callCount(spies: { mock: { calls: unknown[] } }[]): number {
+    return spies.reduce((count, spy) => count + spy.mock.calls.length, 0);
+  }
+}

package/test/DevLoginBootstrapAdmin.test.ts

@@ -6,10 +6,9 @@ import { UserServerTestEnvironment } from './UserServerTestEnvironment';
 const testEnv = new UserServerTestEnvironment();
 
 /**
- * `DEV_BOOTSTRAP_ADMIN_EMAIL` — the first-admin door INSIDE `/dev/login` (n3xa plans/DEV_ESTATES.md
- * D3, founder-ruled 2026-09-04). A dev estate on a fresh real database has no privileged account
- * to grant from, and the no-raw-DB rule forbids the emulator-era seed scripts there — so the ONE
- * sanctioned account door mints break-glass, once:
+ * `DEV_BOOTSTRAP_ADMIN_EMAIL` — the first-admin door INSIDE `/dev/login`. A development server on
+ * a fresh real database has no privileged account to grant from, and a no-raw-database-write rule
+ * forbids seed scripts there — so the ONE sanctioned account door mints break-glass, once:
  *  - behind the door's existing two gates (DEVELOPMENT AND DEV_AUTO_LOGIN_EMAIL): closed = 404 as
  *    before, and the variable changes nothing;
  *  - only while NO account carries 'admin' (the same membership test the app's admin checks make);

package/test/DevLoginStaleCookieFirstHit.test.ts

@@ -28,7 +28,7 @@ const testEnv = new UserServerTestEnvironment();
  * cookies the response set, and the follow-up MUST read as authenticated on the FIRST pass.
  */
 
-const SESSION_COOKIE_NAME = 'n3xa.sid.9876'; // dev cookie-name shape: n3xa.sid.${SERVER_PORT}
+const SESSION_COOKIE_NAME = 'app.sid.9876'; // a consumer's dev cookie-name shape: <app>.sid.${SERVER_PORT}
 const SESSION_SECRET = 'dev-first-hit-test-secret';
 const ENV_EMAIL = 'dev@test.local';
 /** Store commit latency. Generous so a pre-0.6 runtime (write racing the redirect) loses the

package/test/DevMail.test.ts

@@ -0,0 +1,151 @@
+import { EmailSender, MailSink } from '@proteinjs/email-server';
+import { devMail, devMailMessage } from '../src/routes/devMail';
+
+/**
+ * `GET /dev/mail` and `GET /dev/mail/<id>` — the dev-only door onto the mail sink, gated exactly
+ * like `/dev/login`: `DEVELOPMENT` AND `DEV_AUTO_LOGIN_EMAIL`, else 404 as if unregistered. With
+ * the gates open, the last invite a development sender recorded is readable — its link off the
+ * list, its rendered html off the message — so a lane never needs a real inbox. No database:
+ * the sink is the process's own ring.
+ */
+
+const ENV_EMAIL = 'dev@test.local';
+
+type Outcome = { status?: number; body?: unknown; type?: string };
+
+const invoke = async (
+  route: typeof devMail,
+  { query, params }: { query?: Record<string, unknown>; params?: Record<string, string> } = {}
+): Promise<Outcome> => {
+  const outcome: Outcome = {};
+  const response = {
+    status(code: number) {
+      outcome.status = code;
+      return this;
+    },
+    type(kind: string) {
+      outcome.type = kind;
+      return this;
+    },
+    send(body?: unknown) {
+      outcome.body = body;
+    },
+    json(body: unknown) {
+      outcome.body = body;
+    },
+  };
+  await route.onRequest({ query: query ?? {}, params: params ?? {} } as never, response as never);
+  return outcome;
+};
+
+const INVITE_LINK = 'http://localhost:7985/auth/signup?token=abc123';
+const INVITE_HTML = `<html><body><p>You are invited.</p><a href="${INVITE_LINK}">Accept</a></body></html>`;
+
+/** The product's path onto the sink: a development sender with a real-looking SMTP config, no opt-in. */
+const sendInviteThroughSender = async (to: string): Promise<void> => {
+  await new EmailSender({
+    host: 'smtp.test.local',
+    port: 465,
+    secure: true,
+    auth: { user: 'mailbox@test.local', pass: 'unused' },
+    from: '"Example" <hi@example.com>',
+  }).sendEmail({ to, subject: "You're invited", text: `Accept your invite: ${INVITE_LINK}`, html: INVITE_HTML });
+};
+
+describe('devMail routes', () => {
+  const originalEnv = {
+    DEVELOPMENT: process.env.DEVELOPMENT,
+    DEV_AUTO_LOGIN_EMAIL: process.env.DEV_AUTO_LOGIN_EMAIL,
+    EMAIL_TRANSPORT: process.env.EMAIL_TRANSPORT,
+    EMAIL_ALLOW_REAL_SEND: process.env.EMAIL_ALLOW_REAL_SEND,
+  };
+
+  beforeEach(() => {
+    process.env.DEVELOPMENT = 'true';
+    process.env.DEV_AUTO_LOGIN_EMAIL = ENV_EMAIL;
+    delete process.env.EMAIL_TRANSPORT;
+    delete process.env.EMAIL_ALLOW_REAL_SEND;
+    MailSink.get().clear();
+  });
+
+  afterEach(() => {
+    for (const [key, value] of Object.entries(originalEnv)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  });
+
+  it("lists the last sent messages newest first — the invite's recipient, subject, first link and timestamp — and the message renders its html", async () => {
+    await sendInviteThroughSender('earlier@test.local');
+    await sendInviteThroughSender('lane-after@test.local');
+
+    const list = await invoke(devMail);
+    expect(list.status).toBe(200);
+    const { messages } = list.body as { messages: Array<Record<string, unknown>> };
+    expect(messages).toHaveLength(2);
+    expect(messages[0]).toMatchObject({
+      to: ['lane-after@test.local'],
+      subject: "You're invited",
+      link: INVITE_LINK,
+      from: 'hi@example.com',
+      refused: true,
+    });
+    expect(typeof messages[0].id).toBe('string');
+    expect(Date.parse(String(messages[0].at))).not.toBeNaN();
+    expect(messages[0].url).toBe(`/dev/mail/${messages[0].id}`);
+    expect(messages[1].to).toEqual(['earlier@test.local']);
+
+    const message = await invoke(devMailMessage, { params: { id: String(messages[0].id) } });
+    expect(message.status).toBe(200);
+    expect(message.type).toBe('html');
+    expect(message.body).toBe(INVITE_HTML);
+  });
+
+  it('?n= bounds the list; a text-only message renders as text; an unknown id is 404', async () => {
+    process.env.EMAIL_TRANSPORT = 'sink';
+    await new EmailSender({ host: 'h', port: 465, secure: true, from: '"Example" <hi@example.com>' }).sendEmail({
+      to: 'a@test.local',
+      subject: 'Plain',
+      text: 'just text',
+    });
+    await sendInviteThroughSender('b@test.local');
+
+    const one = await invoke(devMail, { query: { n: '1' } });
+    expect((one.body as { messages: unknown[] }).messages).toHaveLength(1);
+    const all = await invoke(devMail, { query: { n: 'garbage' } });
+    const { messages } = all.body as { messages: Array<{ id: string; subject: string; refused: boolean }> };
+    expect(messages.map((m) => m.subject)).toEqual(["You're invited", 'Plain']);
+    expect(messages[1].refused).toBe(false);
+
+    const plain = await invoke(devMailMessage, { params: { id: messages[1].id } });
+    expect(plain.status).toBe(200);
+    expect(plain.type).toBe('text');
+    expect(plain.body).toBe('just text');
+
+    expect((await invoke(devMailMessage, { params: { id: 'nope' } })).status).toBe(404);
+  });
+
+  it('DEVELOPMENT unset → 404 on both paths, even with messages in the sink', async () => {
+    await sendInviteThroughSender('lane@test.local');
+    const [record] = MailSink.get().list();
+    delete process.env.DEVELOPMENT;
+
+    expect((await invoke(devMail)).status).toBe(404);
+    expect((await invoke(devMailMessage, { params: { id: record.id } })).status).toBe(404);
+  });
+
+  it('DEV_AUTO_LOGIN_EMAIL unset (or blank) → 404 on both paths', async () => {
+    await sendInviteThroughSender('lane@test.local');
+    const [record] = MailSink.get().list();
+
+    delete process.env.DEV_AUTO_LOGIN_EMAIL;
+    expect((await invoke(devMail)).status).toBe(404);
+    expect((await invoke(devMailMessage, { params: { id: record.id } })).status).toBe(404);
+
+    process.env.DEV_AUTO_LOGIN_EMAIL = '   ';
+    expect((await invoke(devMail)).status).toBe(404);
+  });
+});